How to read array size from over-allocated memory block?

It is platform dependent. delete[] uses different mechanisms depending on the type. For trivial types, it just calls free(). For non-trivial types, it reads the stored count, calls destructors, then calls free().

It is not a good idea to depend on what delete[] does under the hood, but you might want to look at https://man7.org/linux/man-pages/man3/mallocusablesize.3.html if you are curious.

As people noted in comments, these things are parts of low-level implementation. They are not documented, and that is a good thing because in case of a bug (unlikely but possible) it could be fixed in next version without breaking anyone's code.

So you have two ways to find out how it works exactly - look at the code or experiment and guess. You have already started going the second way. It's not guaranteed that you get reliable results but it can be fun!

As for the significance of the number 33 — my guess is, it's a bitfield thing. The implementation knows that the size of the memory block is always divisible by 16, so it frees lower 4 bits to hold any useful info. Does it use them to hold the "non-trivial destructor" flag? It's easy to verify!

What other useful flags could it hold? You could traverse the whole heap and look for blocks which have other values of these 4 bits. Then try to guess what they mean.